cloudstack-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <>
Subject [jira] [Commented] (CLOUDSTACK-10153) Sanitize string arguments in API requests for XSS scripts
Date Thu, 23 Nov 2017 07:41:00 GMT


ASF GitHub Bot commented on CLOUDSTACK-10153:

rhtyd opened a new pull request #2336: CLOUDSTACK-10153: Introduce string API arg trust validation
   Adds new API string argument/field validator that validates the string
   as untrusted HTML using owasp's java-html-sanitizer. This also adds
   a API argument validator type to skip validations, useful for fields
   such as certificates and keys.
   Signed-off-by: Rohit Yadav <>

This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:

> Sanitize string arguments in API requests for XSS scripts
> ---------------------------------------------------------
>                 Key: CLOUDSTACK-10153
>                 URL:
>             Project: CloudStack
>          Issue Type: Bug
>      Security Level: Public(Anyone can view this level - this is the default.) 
>            Reporter: Rohit Yadav
>            Assignee: Rohit Yadav
>             Fix For: Future
> API requests made using the CloudStack UI does not allow use of special characters "<"
and ">", however direct API requests made using clis such as cloudmonkey may pass unsanitized
string API arguments to backend. A backend sanitizer can be put in to filter string API argument
and remove possible XSS scripts using libraries such as

This message was sent by Atlassian JIRA

View raw message